Civil and Administrative Tribunal New South Wales Medium Neutral Citation: ALZ v WorkCover NSW [2015] NSWCATAP 138 Hearing dates: On the papers Date of orders: 10 July 2015 Decision date: 10 July 2015 Jurisdiction: Appeal Panel Before: Acting Judge K P O'Connor, AM, Deputy President, Appeals P H Molony, Senior Member Decision: 1.The appeal is allowed in relation to the ruling of the Tribunal that the organisation did not contravene HPP 6. 2. That ruling is set aside. 3. Instead a finding is substituted that the respondent contravened HPP 6. 4. Otherwise the appeal is dismissed. 5. The application is remitted to the Tribunal for the making of orders in relation to the contraventions found by it, and the additional contravention the subject of Order 3. Catchwords: PRIVACY – Health Information – Complaint by employee to regulatory agency alleging bullying - agency obtained medical report about complainant from complainant's employer without notice to complainant –whether that conduct and subsequent use and other action compliant with Health Privacy Principles – Appeal by review applicant against Tribunal findings of non-contravention – Tribunal finding set aside in relation to compliance with Health Privacy Principle 6 – Finding of contravention entered – otherwise appeal dismissed. Health Records and Information Privacy Act 2002, Health Privacy Principles 1, 5, 6, 9, 10, 11. Legislation Cited: Administrative Decisions Tribunal Act 1997 Administrative Decisions Review Act 1997 Civil and Administrative Tribunal Act 2013 Government Information (Public Access) Act 2009 Health Records and Information Privacy Act 2002 Occupational Health and Safety Act 2000 Privacy and Personal Information Protection Act 1998 Privacy Act 1988 (Commonwealth) Privacy Act 1983 (Canada) State Records Act 1998 Cases Cited: Collins v Urban [2014] NSWCATAP 16; General Newspapers Pty Ltd v Telstra Corporation [1993] FCA 473; (1993) 117 ALR 629; HW v Commissioner of Police, New South Wales Police Service [2003] NSWADT 215; In re An Inquiry Under The Company Securities (Insider Dealing) Act 1985 (1988) AC 660; KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 SB v Roads and Traffic Authority [2010] NSWADT 255; Seven Network (Operations) Ltd v Media Entertainment and Arts Alliance (2004) 148 FCR 145. Texts Cited: For Your Information: Australian Privacy Law and Practice [2008] ALRC 108 Category: Principal judgment Parties: ALZ (Appellant) WorkCover NSW (Respondent Representation: In person (A) Crown Solicitor (R) File Number(s): 14/46389 Decision under appeal Court or tribunal: Civil and Administrative Tribunal Jurisdiction: Administrative and Equal Opportunity Division Citation: ALZ v WorkCover NSW [2014] NSWCATAD 49 Date of Decision: 24 April 2014 Before: S Montgomery, Senior Member File Number(s): 123291; 133003 REASONS 1. The appellant has applied to the Tribunal under the Health Records and Information Privacy Act 2002 (HRIPA or the Act) for review of the respondent agency's conduct in relation to a confidential medical report about her. She considers that the agency contravened the Health Privacy Principles (HPPs) laid down by that Act in a number of respects. The HPPs protect individuals in relation to the collection, storage, use and disclosure of their health information by 'organisations'. A 'public sector agency' is one of two types of organisation bound by the Act. The respondent is a 'public sector agency'; and is bound by the Act (ss 4, 11). 2. In summary, the Tribunal below has found that the respondent contravened three of the HPPs in its dealings with the appellant's health information, namely HPP 3 (direct collection), HPP 4 (notice of practices when collecting information) and HPP 5(1)(c) (security safeguards). It found not proven alleged contraventions of HPP 1 (permitted purposes of collection), HPP 6 (general notice of information holdings and access rights), HPP 9 (ensuring information used is accurate and relevant), HPP 10 (limitations on use of health information) and HPP 11 (limitations on disclosure of health information). The appellant now appeals against the rulings negative to her. There is no appeal from the respondent in relation to the rulings negative to it. 3. The Tribunal remains part-heard, as it is yet to make final orders pending resolution of this appeal. Though the proceedings may be said to be interlocutory in character, the appeal is, we consider, governed by s 80(2)(b) of the Civil and Administrative Tribunal Act 2013 (NCAT Act). This conclusion is explained later in these reasons. We do not consider it to be an appeal against an 'interlocutory decision' and therefore subject to s 80(2)(a). The point of difference is that s 80(2)(b) confers a right to appeal in relation to questions of law (with leave required to extend to 'other grounds'), whereas appeals under s 80 (2)(a) require leave, regardless of the nature of the grounds. Background 1. The appellant's review application has its origin in a complaint she made to the respondent on 20 September 2011. She complained to the respondent that she had been subject to bullying in the workplace by senior staff of her employer - the local Council. She had for many years worked as an aide in child care centres run by the Council. The respondent has a wide range of statutory functions relating to health and safety in the workplace. They include the independent investigation of workplace complaints going to health and safety. The respondent appointed one of its inspectors (Inspector Dall) to conduct an investigation into her complaint and report back. 2. Separately, the appellant made a worker's compensation claim for psychological injury which was referred by her employer to the insurer. She attended an assessment by a psychiatrist engaged by the insurer on 11 November 2011. 3. On 6 December 2011, the inspector interviewed three Council officers connected to the complaint. They informed him that she had made a workers compensation claim, and of the fact that the appellant had been assessed by the insurer's psychiatrist. The Council held a copy of the report. The inspector asked to see that report. He received it on 15 December 2011. The psychiatrist was of the opinion that the appellant did not have any work related psychological injury. The report included reference to the bullying allegations. The inspector made his final report on 19 January 2012, and it was endorsed by his supervisor. The inspector found the bullying complaint not established. In the report he drew support from the psychiatrist's report, and quoted a paragraph of the report. (We will refer henceforth to the report as the 'medical report', in line with the usage of the Tribunal below.) 4. On 7 December 2011, the day after the meeting with the Council officers, the inspector and the appellant had contacted each other over the progress of the investigation. The inspector informed her that he had 'closed' his investigation and he had concluded that her complaint was not established. 5. The appellant subsequently sought access to the records of the investigation by means of an application under the Government Information (Public Access) Act 2009. In March 2012 she received a number of documents. The disclosed: the contents of the medical report; that it had been obtained and used by the inspector; and that copies of it were now held by WorkCover, and accordingly its location was no longer securely confined to her employer and the employer's insurer. 6. 'Health information' is a sub-set of 'personal information', and these terms are defined by ss 5 and 6 of the Act. There is no dispute that the contents of the medical report constituted 'health information'. Public sector agencies are bound to adhere to a set of standards similar but not identical to the HPPs in their handling of personal information that is not health information. These are the Information Protection Principles (IPPs) laid down by the Privacy and Personal Information Protection Act 1998 (PPIPA). The procedures governing the making of review applications, and in regard to the orders the Tribunal may make, are assimilated to those governing PPIPA applications in the case of public sector agencies: see HRIPA, s 21. 7. The appellant exercised her right under s 53 of PPIPA to apply to the respondent for internal review of its conduct in relation to the medical report. She made two applications (16 July 2012, 28 September 2012), the second referring to a number of matters additional to the first application. The respondent's responses were made, respectively, on 14 September 2012 and 5 December 2012. The respondent found no contraventions. 8. She lodged external review applications with the Tribunal on, respectively, 11 October 2012 and 7 January 2013, as is permitted by PPIPA s 55. The application takes the form of an application for review in the administrative review jurisdiction of the Tribunal. Consequently the Tribunal's task is to make the 'correct and preferable' decision on the matters raised. Section 63(1) of the Administrative Decisions Review Act 1997 (ADR Act) provides: 63 Determination of administrative review by Tribunal (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. 1. ('Administratively reviewable decisions' is to be read as 'administratively reviewable conduct': see further, ADR Act, s 7). The Tribunal's Decision 1. The Tribunal's findings of contravention of HPP 3 and HPP 4 are the subject of its main decision, ALZ v WorkCover NSW [2014] NSWCATAD 49 (24 April 2014). The finding of contravention of HPP 5(1)(c) is the subject of its supplementary decision ALZ v WorkCover NSW (No 2) [2014] NSWCATAD 122 (29 August 2014). 2. The Tribunal had before it a large amount of material. The appellant's material included submissions, and some related statements and documents (completed July 2013). As to the steps it took in collecting and using the medical report, the agency filed affidavits from Inspector Dall, and his colleague, Inspector Gary Mason. The agency's submissions (7 June 2013) attached a bundle of exhibits, being: WorkCover NSW, Privacy Management Plan, dated September 2008; WorkCover NSW, Workplace Complaints Handling – relating to OHS and associated legislation, dated June 2006; and three emails, two from the applicant and one from WorkCover in response. The Tribunal also had before it the two internal review reports issued by the respondent. 3. The Tribunal chose to deal with the matter on the papers, a course permitted by applicable legislation (Administrative Decisions Tribunal Act 1997, s 76; replaced as from 1 January 2014 by the NCAT Act, s 50). Summary of Tribunal Findings of Contravention 1. It is helpful, we think, for the sake of context to summarise briefly the Tribunal findings adverse to the agency. HPP 3 provides relevantly that 'an organisation must collect health information about an individual only from that individual, unless it is unreasonable or impracticable to do so'. A provision of the kind seen in HPP 3 is a usual feature of Australian and international data privacy laws (see, for example, Privacy Act 1988 (Commonwealth), Australian Privacy Principle (APP) 3.6; Privacy Act 1983 (Canada), s 5(1)). It seeks to guard against indirect collections of health information. It reflects the view that individuals are better able to control the flow of personal information about themselves if they are directly involved in the giving of that information. Moreover, their direct involvement has the further benefit of providing transparency, and enabling them to prevent unnecessary harm to their privacy interests. 2. The agency had, as we have outlined, collected the medical report from a third party. In this instance the Tribunal considered that the inspector having learnt of the report, should have considered obtaining the psychiatrist's report via the appellant, and not cut her out of the loop. He might have been able to avoid an act of indirect collection, and she would not have been 'deprived of the opportunity to make a decision in relation to the provision of the medical report' (decision no 1, [79]). This was not a case where secrecy of investigation or some like interest required the exclusion of the affected individual from the information collection process; and no submission was put to that effect. The inspector, in essence, said that he had assumed that the insurer had practices that meant that an employee the subject of a medical report obtained by the insurer would receive a copy of the report. 3. Organisations are required by HPP 4 to 'take steps that are reasonable in the circumstances' to ensure that the individual 'is aware' of the organisation's practices in relation to health information collected about them, and their rights in relation to that information. It has as its specific focus the information collection practices of the agency. A provision of this kind is a usual feature of data privacy laws (see for example, APP 5; Canada, s 5(2), s 11). 4. The organisation's notice is required to cover the eight categories of information set out in the HPP. HPP 4(1) deals with the steps that should be taken to notify the affected individual of those matters where there is a direct collection from that individual. HPP 4(2) deals with the steps to be taken where the collection is from 'someone else' (the present circumstance). HPP 4(2) provides that the organisation 'must take steps that are reasonable in the circumstances' to ensure that the individual is made 'generally aware' of the eight matters listed in HPP 4(1). There are two exceptions to the HPP 4(2) requirement; neither is raised by this case. 5. The respondent did not seek to establish that it had complied with HPP 4(2). HPP 4(4) excuses on various grounds organisations from compliance with HPP 4(1) and (2). One of those grounds is HPP 4(4)(e) - 'the information is collected for law enforcement purposes'. The respondent relied on this ground and others. The Tribunal rejected its contentions, and found a breach of HPP 4 (see [99]-[102]). 6. HPP 5 places general obligations on organisations in relation to the retention and security of health information, subject to certain dispensations and an exception for 'investigative agencies' (see s 4(1) - the respondent is not such an agency). The appellant's concern related to, what she considered to be, the lack of clarity as to how many copies of the medical report were held by the respondent in paper or electronic form, and whether they were adequately secured. The issue was dealt with by the Tribunal as one governed by HPP 5(1)(c) which provides: An organisation that holds health information must ensure that: (c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access use, modification or disclosure, and against all other rmisuse. 1. The Tribunal held in its main decision that the respondent had not contravened this standard in relation to the copies held in its investigations database and its archives database. 2. However, the Tribunal was uncertain on the basis of the material before it (the respondent could not specify how many copies of the report it held in its system), in relation to whether there were copies held elsewhere in the organisation and the adequacy of their security. A particular concern of the appellant, because of what she saw as a lack of security safeguards, was that officers of the respondent would be able to access her medical report without her knowledge or consent for secondary purposes. The Tribunal received further evidence in that regard from the respondent, and this issue was the subject of the supplementary decision. 3. The Tribunal did not accept the respondent's evidence as satisfactory, referring to continued lack of clarity as to the number of copies held, continued lack of clarity as to the standard of security applied to documents such as the medical report, and the intrinsic sensitivity of a medical report of the present kind. It was not satisfied that the respondent had adequate security measures to protect against unauthorised access, and that constituted a breach of HPP 5. The reference to 'unauthorised access' indicates to us that, put more precisely, the Tribunal made a finding of contravention of HPP 5(1)(c) otherwise than in relation to the copies held in the two storage locations named in the main decision. The Appeal 1. The appeal was filed on 22 May 2014, and related to the Tribunal's first decision. It was accompanied by a statement of grounds of appeal, and the respondent lodged a reply. The Appeal Panel deferred the timetable for the submissions, and directed the Tribunal to finalise its decision in relation to the HPP 5(1)(c) issue, giving rise to the supplementary decision. Given the outcome, the appellant did not amend her appeal. Consequently the appeal relates only to the main decision. After the second decision was published, the Appeal Panel fixed a submissions timetable. The appellant's submissions are voluminous, and they include additional submissions that fall outside the original directions timetable, and a fresh statement, in the nature of evidence. 2. The parties agreed to have the appeal determined on the papers (as previously noted, a course permitted by s 50 of the NCAT Act). The Tribunal at first instance had also dealt with the matter on the papers. 3. We noted earlier in these reasons our conclusion that the appeal is governed by s 80(2)(b) of the NCAT Act. There was some uncertainty in the submissions as to whether the appeal is governed by paragraph (a) or paragraph (b) of s 80(2). (2) An internal appeal may be made: (a) in the case of an interlocutory decision of the Tribunal at first instance – with the leave of the Appeal Panel (b) in the case of any other kind of decision (including an ancillary decision) of the Tribunal at first instance – as of right on any question of law, or with the leave of the Appeal Panel, on any other grounds'. 1. As the case at first instance is not finalised, it might be argued that this appeal is interlocutory in character. Section 80(2)(a) deals with appeals against an 'interlocutory decision'. That term has the following meaning: interlocutory decision of the Tribunal means a decision made by the Tribunal under legislation concerning any of the following: (a) the granting of a stay or adjournment, (b) the prohibition or restriction of the disclosure, broadcast or publication of matters, (c) the issue of a summons, (d) the extension of time for any matter (including for the lodgment of an application or appeal), (e) an evidential matter, (f) the disqualification of any member, (g) the joinder or misjoinder of a party to proceedings, (h) the summary dismissal of proceedings, (i) any other interlocutory issue before the Tribunal. 1. Items (a) to (g) refer to a type of procedural or evidentiary decision made in the course of proceedings. A summary dismissal brings proceedings to an end (category (h)). It is a procedural order in the sense that it is made without undertaking a full hearing, and can be reopened on narrow grounds. The decision under notice in this appeal is a final, reasoned decision disposing of the liability issues in the case. In our opinion, it is a decision of different type to the ones listed in the definition of 'interlocutory decision'. 2. We have therefore dealt with the appeal as one governed by paragraph (b. Scope of Appeal 1. The primary matters seen to raise questions of law appear at paragraphs 9 and 10 of the notice of appeal, and then amplified. Other matters seen as raising questions of law are set out at paragraph 8. 2. The appellant has also applied for leave to extend the appeal to grounds other than questions of law. She seeks orders that would allow her to produce further evidence and to cross-examine witnesses. She asks for the decisions to be set aside insofar as they are negative to her case, and for the application to be remitted to a Tribunal, differently constituted. Alternatively, she invited the Appeal Panel to extend to the merits, and redetermine the matter. 3. The respondent's submissions support the reasoning of the Tribunal in relation to questions of law, and submit that the discretion to grant leave to extend the appeal to 'other grounds' should not be exercised (referring to observations as to the nature of the discretion made in Collins v Urban [2014] NSWCATAP 16 at [84]). 4. It is inimical to a process of this kind that fresh evidence be sought to be tendered, and we have not had regard to the appellant's latest statement. 5. By way of introduction, we note again that the Tribunal dealt with the case on the papers. Importantly in this case, that meant the agency evidence before the Tribunal went unchallenged. The primary evidence in that regard are the affidavits of the inspector who undertook the investigation (Michael Dall, dated 11 April 2013) and the inspector who first received the complaint (Gary Mason, dated 10 April 2013). It was open to the Tribunal to rely on that evidence, and it did so at a number of points of its reasoning. The notice of appeal seeks orders that might allow the appellant to test directly that evidence. Ruling in respect of HPP 1 1. We have given a summary of the history earlier in these reasons. As noted, the appellant believed that the respondent's investigation had been completed as at 7 December 2011. Nonetheless, as had been requested by the inspector, on 15 December 2011 her employer provided him with a copy of the medical report obtained by the insurer. On 19 January 2012, the inspector formally entered a report of his finding into the respondent's 'Workplace Services Management System', and recommended that no further action be taken. His report quoted a paragraph from the medical report in support of his conclusions. Mr Paul Irwin, the respondent's District Coordinator subsequently confirmed Inspector Dall's conclusions. 2. HPP 1 provides: 1 Purposes of collection of health information (1) An organisation must not collect health information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the organisation, and (b) the collection of the information is reasonably necessary for that purpose. (2) An organisation must not collect health information by any unlawful means. 1. The Tribunal held that the collection of the report complied with each of HPP 1(1)(a) and (b) and HPP 1(2). The appeal challenges each of these conclusions. 2. HPP 1(1)(a). We will not repeat here the account given in the reasons below of the extensive statutory powers vested in the respondent in relation to investigation of workplace complaints and in relation to its powers to request or compel the provision of information relevant to its functions. In our view, for the reasons given by the Tribunal, they clearly establish that a collection of the present kind relates to a lawful purpose directly related to a function or activity of the organisation (a medical report that canvassed a range of circumstances among which was the conduct the subject of the complaint under investigation). In our opinion, the Tribunal did not err in law in relation to the issue of compliance with HPP 1(1)(a). 3. HPP 1(2). Similarly, this is not a case of the use of an unlawful means of collection (HPP 1(2)), as might arise for example if some form of surreptitious collection had been used to obtain the medical report. In her submissions the appellant argues by reference to various provisions of the OHS Act that the inspector adopted 'unlawful means' and thereby breached HPP1(2). The Tribunal set out in its reasons the extensive powers vested in the respondent's inspectors, in particular ss 59 and 62 of the Occupational Health and Safety Act 2000 (OHS Act), the then applicable legislation. The Tribunal set out a long extract from the inspector's evidence to the Tribunal at para [55] of its reasons. 4. The means used by the inspector - the making of a request which had as its context the powers available to the agency to compel the provision of information – is one of an orthodox kind in the conduct of statutory investigations. If the holder of information gives up the information to the requesting party without requiring compulsory process to issue, that does not make, by that fact alone, the collection an unlawful means of obtaining information. Investigations would be often greatly delayed if investigators had to resort to the issuance of compulsory process in relation to all requests for assistance. The person or organisation to whom the request for co-operation is directed makes its own decision as to whether it has the power or right to give up the information without the need for a formal demand or service of a summons. 5. The inspector did not use any special techniques of investigation that might invite debate as to the lawfulness of the means, such as covert listening or filming. It is to be noted that the NSW provision is narrower in this respect than the Commonwealth provision which obliges a regulated entity to collect personal information not only by lawful means by 'fair means' (see APP 3.5). 6. HPP 1(1)(b). The submission of the appellant which is more arguable relates to the question of compliance with HPP 1(1)(b). The appellant's primary contention was that the respondent did not have any need for the report, given the inspector's statement to her as at 7 December 2011 that his investigation was complete, and his indication to her of his final opinion as to whether her complaint had been established. The submission is that there was no need of any kind for the report to be accessed. 7. Inspector Dall's email dated 7 December 2011 to the appellant is at Attachment 4 of his affidavit before the Tribunal. The email uses language of finality. The opening words are: investigation into your complaint of bullying is now complete, inclusive of the reviewing of additional documentation. 1. A brief explanation is given for reaching this conclusion, and it concludes: Considering all the circumstances it is my opinion the matters brought to my attention and the subsequent dealings of these issues by council do not constitute Bullying. 1. Inspector Dall however added in his affidavit sworn 11 April 2013 that what he had said to the appellant represented his findings 'to date'. He continued: I said that my investigation was complete because, from a practical viewpoint I had considered a wide range of information (including information provided by the applicant) and had a sound basis for deciding to take no further action. I did not tell the applicant that I was awaiting further material, such as medical reports, even though I intended that any further material would assist me in coming to a final decision in the investigation. 1. This is a similar position to that taken in the internal review report of the respondent dated 5 December 2012, where the respondent's privacy officer said: I also understand that Inspector Dall contacted you by email on 7 December 2011 to provide feedback on the investigation and confirm his findings in relation to policies and procedures in place at the Council. When dealing with complaints, inspectors often provide feedback at an early stage to the complainant as to whether their complaint has been substantiated or not. Further issues at the site, or matters the inspector wishes to clarify, can continue on well beyond this contact with the complainant, which is often the case if notices are issued. … In this instance, I can confirm that Inspector Dall did not complete his investigation into your complaint until 19 January 2012 and the outcomes were reviewed by his District Coordinator on 23 January 2012 as part of the normal review process. 1. The appellant submitted, alternatively, that if the investigation had not concluded the collection did not fall within the exception to the prohibition on third party permitting such a collection if it is 'reasonably necessary for that purpose'. 2. The Tribunal did not address expressly the first point (the investigation had closed, therefore no need to undertake any further collection of information), but did address the question of whether the collection was 'reasonably necessary. The Tribunal said: 61 Inspector Dall gave evidence that he requested copies of any medical reports relating to the Applicant's workers compensation claim at a meeting on 6 December 2011. This request would have captured the medical report and he clearly had not received it prior to his 7 December 2011 advice to the Applicant that his investigation was complete. Notwithstanding the advice that Inspector Dall gave to the Applicant on 7 December 2011, his investigation was clearly not complete. He intended to consider the further material that he had requested from the Council as part of his investigation and he did so. It is apparent that he had reached a preliminary view on 7 December 2011 and his view was ultimately adopted in his report "Inspector's Report" dated 19 January 2012. 62 Inspector Dall's evidence is that he formed the view that the reason for the refusal of the Applicant's workers compensation claim was relevant to the investigation of her complaint of bullying. Both matters concerned a complaint of bullying. 63 In SB v Roads and Traffic Authority [2010] NSWADT 255 I stated the view that the expression "reasonably necessary" must take on its natural meaning. I further stated at paragraph [35] that that the expression is meant to be something less than essential. 64 The Applicant has asserted that Inspector Dall was obligated by HPP 1 to determine in advance that any health information he proposed to collect would ultimately be relevant in some way, and it should be determinative of some factor relevant to the purpose of collection. I do not totally agree with this submission. 65 In my view, it is reasonable to expect that a request for the medical report was based on a conclusion that the report might be relevant to some factor in his investigation. However, without inspection the medical report he was not in a position to know the extent of its relevance and whether or not it would be determinative. 66 In my view, Inspector Dall's opinion that the medical report might be relevant to the investigation of the Applicant's complaint was reasonable. If the content of the report had assisted the Applicant's claim Inspector Dall would have been remiss in not considering it. The reverse must also apply. 67 In the circumstances, I agree with the Respondent that no breach of HPP 1 is established. 1. In our view, the Tribunal clearly proceeded in the passages quoted on the premise, despite what Inspector Dall had said to the appellant in his email of 7 December 2011, that the investigation was not finished. It impliedly adopted the evidence of the inspector and the position expressed by the internal review officer, which we have quoted earlier. It would have been better had the Tribunal directly dealt with this point. The appellant has, we consider, an understandable sense of grievance over not being dealt with in a frank way on the occasion of the 7 December interchange, in not being informed that something as sensitive as a medical report that concerned her psychological health was to be considered, and in not being told that the investigation was not fully finalised. The Tribunal member did acknowledge that point in his holding in respect on non-compliance with HPP 3. 2. What may be seen as 'reasonably necessary' falls towards the higher end of a continuum that might be seen as having 'of some relevance' at one end and 'essential' at the other end. In General Newspapers Pty Ltd v Telstra Corporation [1993] FCA 473; (1993) 117 ALR 629 at [38] Gummow J said (there considering the use of the term 'necessary' in a Commonwealth telecommunications law): The term "necessary" will take its colour from its context; in ordinary usage it may mean, at one end of the scale, "indispensable" and at the other "useful" or "expedient": In re An Inquiry Under The Company Securities (Insider Dealing) Act 1985 (1988) AC 660 at 704. 1. Clearly it is not enough merely for the agency to make a self-serving assertion that the conduct is necessary. Its explanation must be appraised in an objective way: as illustrated by the approach adopted by Gyles J in Seven Network (Operations) Ltd v Media Entertainment and Arts Alliance (2004) 148 FCR 145 where he found a contravention by a private sector organisation of National Privacy Principle 1.1. 2. One of the appellant's contentions is that the Tribunal erred by simply treating the subjective judgment of the officer as sufficient to satisfy the requirement of HPP 1(1)(b). As the Tribunal did, it is appropriate to take into account the subjective judgment of an officer experienced in the conduct of workplace complaint investigations. The Tribunal did not stop at that, and, in our view, it did proceed to make its own judgment in an objective way. 3. Nor did it go so far as suggested by the appellant, and exonerate the respondent from having to address the question whether a collection was one for which there was a 'reasonable necessity' at the time of collection, and allow it to defer that consideration until after it received the material. 4. In its statements at para [65], the Tribunal, as we see it, was simply alluding to the point that in an investigative context an item of information to which an investigator's attention has been drawn may seem 'reasonably necessary' to be obtain based on what the investigator has been told about it, and then may turn out on receipt and closer examination to have none or limited value and relevance to the process. The standard laid down by HPP 1(1)(b) must, as we see it, be applied fairly and have regard to the uncertainties that will often surround the initial decision to collect information, especially in investigative contexts. 5. We consider that the Tribunal having proceeded on the premise that it did (one open to it on the evidence) did not err in law in the way it then dealt with the question of whether the collection was 'reasonably necessary'. 6. The appeal in relation to HPP 1 is rejected. Ruling in relation to HPP 5 1. As already noted, the Tribunal did find a contravention of HPP 5(1)(c). 2. HPP 5(1)(a) and (b) provide that: An organisation that holds health information must ensure that: (a) the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used; (b) the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information. 1. In the notice of appeal the appellant contended that the Tribunal should have found a breach of HPP 5(1)(a) because the agency was holding the information unlawfully. She develops this point at paras [62]-[64] of her submissions, relying on arguments that seek to draw on HPP 3 and HPP 4. The respondent replied that the finding that the collection was lawful disposed of the HPP 5(1)(a) issue. We have not disturbed that finding. We agree with the respondent. 2. The appellant's further argument is that, given the Tribunal's finding in relation to non-compliance with HPP 5(1)(c), it must follow that HPP 5(2)(b) cannot be satisfied. The respondent made submissions as to the merits of this contention. Further it argued, in the alternative, that it is in any case excused from compliance with HPP 5(1)(a) and (b) in relation to the long term retention of the document because of its records management obligations under section 12 of the State Records Act 1998, as provided for in HPP 5(2)(b)). 3. We are not disposed to deal with these competing submissions in relation to HPP 5(1)(b). A key principle in privacy litigation before the Tribunal is that the scope of the proceedings is limited to the matters put in issue in the internal review process. As outlined in KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 at [13] In our view, it is clear from the scheme of the Act, in particular ss 53 and 55, that the scope of the application for internal review, reasonably construed, provides the scope for the agency's examination of the application. Unless there is some widening of the application within that process which is accepted by the agency, the application for internal review, reasonably construed, sets the scope for the application for review of the conduct by the Tribunal. It is plain from the scheme of the Act that the Parliament intended that the agency have the first opportunity, always, to deal with the matters of complaint. 1. We have reviewed the internal review application forms and the internal review determinations. Fairly read, the issue raised in that process by the appellant related to the number of copies of the medical report made by the respondent, the hands they had passed through, and their present location in the agency and the security safeguards surrounding those locations. In our view, these were the matters that defined the scope of the application before the Tribunal, and the Tribunal addressed them in its consideration of compliance with HPP 5(1)(c), and made a ruling favourable to the appellant. Ruling in relation to HPP 6 1. Further to the point just made in relation to the scope of the proceedings before the Tribunal, our review of the internal review applications and the internal review determinations found no clear reference to the HPP 6 issue. This issue appears to have first been canvassed actively before the Tribunal, and the respondent acceded to that course. 2. HPP 6 places broad obligations on agencies to take reasonable steps to ensure that individuals know what kinds of health information are held by the agency, and for what purposes and how to exercise their right to access that information. It provides: Information about health information held by organisations (1) An organisation that holds health information must take such steps as are, in the circumstances, reasonable to enable any individual to ascertain: (a) whether the organisation holds health information, and (b) whether the organisation holds health information relating to that individual, and (c) if the organisation holds health information relating to that individual: (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to request access to the information. (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ). 1. One of HRIPA's specific purposes is that of 'promoting fair and responsible handling of health information' by '(b) enabling individuals to gain access to their health information' (HRIPA, s 3(1)). The objects of the Act include 'to enhance the ability of individuals to be informed about their health care' (s 3(2)(b)). As the Tribunal below noted, this provision is the equivalent of s 13 of PPIPA, the sixth of the IPPs. This kind of Principle is often described as the 'Openness' Principle, and is one of two Principles in HRIPA and PPIPA addressed to that end, the other being HPP 4, the IPP equivalent being s 10. 2. HPP 4 and s 10 are obligations of a systemic kind. As noted by O'Connor P in HW v Commissioner of Police, New South Wales Police Service [2003] NSWADT 215 at [58]: 'The provision has, as I see it, to do with a systemic obligation owed by agencies generally to the community.' In its Report, For Your Information: Australian Privacy Law and Practice [2008] ALRC 108 at [24.10], the Australian Law Reform Commission said: Openness provisions require agencies and organisations to make their general practices relating to the handling of personal information transparent. The requirement is not targeted exclusively for the benefit of those whose personal information has been, or is to be, collected. The obligation attaches regardless of whether an agency or organisation has actually collected personal information from a particular individual, or plans to do so. 1. In the case of HW v Commissioner of Police the Tribunal decided that it was unnecessary to address the issue of compliance with this Principle because it was satisfied that the complainant had specific knowledge of each of the matters itemised in (a), (b) and (c)(i) to (iii), as they related to the particular misuse of his information that had put in issue by him. The present case is, in contrast, one where the agency took no specific steps to inform the appellant that it held a copy of the medical report, the purpose of use of the report, and her entitlement to request access to it (see reasons [127]). 2. The question therefore before the Tribunal in this case was whether the respondent had taken: such steps as are, in the circumstances, reasonable to enable any individual to ascertain: (a) whether the organisation holds health information, and (b) whether the organisation holds health information relating to that individual, and (c) if the organisation holds health information relating to that individual: (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to request access to the information. 1. In its reasons, the Tribunal commenced by summarising the respondent's submissions, and summarising the appellant's submission. As the Tribunal's conclusion was favourable to the respondent's case, we will set out its account of the respondent's submissions, and its resolution of the competing submissions: 119 The Respondent submitted that it publishes information that is publicly available on its website, including its Privacy Management Plan, about its policies and procedures in relation to personal information and health information. The Privacy Management Plan has been available to the public since its first publication (including on the Respondent's website) and was available to the public during and after Inspector Dall's investigation. 120 Further, with respect to the Applicant's particular health information, the Respondent submitted that the Applicant was aware at all relevant times of the identity of Inspector Dall and was in a position to enquire as to the health information that the Respondent held, the purpose for which it was used and/or the Applicant's entitlement to request access to the information. … 128. I am satisfied that the steps taken by the Respondent to provide transparency generally to the community meet the requirements of HPP 6. 1. The submission recorded at [120] is an irrelevance. HPP 6, as explained, imposes an obligation of a systemic kind. The individual is not drawn into the operation of the Principle. It does not place any burden on the individual to take steps by way of direct communication with the agency to find out the answers to the issues to which HPP 6 refers. 2. The Tribunal's finding at [128] has as its only basis the submissions of the respondent, and they were summarised at [119]. The detail of the respondent's submissions is to be found, mainly, at paras [70] and [71] of its submissions to the Tribunal dated 7 June 2013. The key passages are these. WorkCover publishes information that is publicly available on its website, including its Privacy Management Plan (September 2008) (See WorkCover Exhibit 1) about its policies and procedures in relation to personal information (see, for example, paragraphs 1.1, 1.2, Chapter 2, paragraph 2.2 and 3.3 of the Privacy Management Plan). The Privacy Management Plan has been available to the public since its first publication (including on WorkCover's website) and was available to the public during and after Inspector Dall's investigation. 1. It is not clear to us whether the Tribunal examined the paragraphs cited. We have done so. 2. Paragraph 1.1 simply states that the respondent has an obligation under 'the Privacy Act' (called PPIPA in these reasons) to develop a Privacy Management Plan, and notes that, following the enactment of HRIPA in 2002, the Plan was reviewed to take account of 'the Health Records Act' (called HRIPA in these reasons). Paragraph 1.2 refers to the 'scope' of the Plan and states that it covers all personal information held by WorkCover, and has four dot points as to what is covered. Neither of these paragraphs address directly the requirements of HPP 6. 3. Paragraph 2.2 is headed 'Compliance – how we meet the Information Protection Principles'. At paragraph 2.2.6 under the heading 'Transparent' there is what amounts to a paraphrase of IPP s 13, the equivalent of HPP 6. It does not contain any of the more specific information to which HPP 6 (and IPP s 13) refers. 4. At 3.3 the heading is 'How WorkCover manages access to and amendment of personal information'. The details in relation to a request for access and amendment arguably meet the requirements of HPP 6(1)(c)(iii). 5. The respondent also argued in its appeal submissions, in a way somewhat similar to the one recorded at [120] of the Tribunal's reasons and properly disregarded, that the statements in the Privacy Management Plan, when combined with what a complainant to the agency might reasonably be expected to understand about its functions, satisfies the obligations imposed by HPP 6(1)(a) and, perhaps, (b), and, perhaps, the more specific obligations imposed by s 6(1)(c). 6. Consideration. Where an organisation is called to account in relation to its compliance with HPP 6, it is required, in our opinion, to demonstrate to the Tribunal, to a reasonable level of satisfaction, that it has complied with HPP 6. 7. In our view, the question of what is reasonable in the circumstances is to be informed by the goals of the Act. HRIPA and PPIPA each seek to provide a means by which individuals can find out for themselves what information is likely to be held about them by the agencies with which they deal. They seek to encourage agencies to be transparent and open in a way that assists individuals in ascertaining the answer to those questions. The individual should be able to obtain that broad information without having to interact directly with a specific functionary such as the inspector in this case, or the treating doctor in the more conventional health setting. In this way the individual is given a role in monitoring what health information is likely to be held about them, and how they can go about accessing it, and seeing for themselves that it is being used and managed appropriately. 8. The respondent is the State's primary enforcer of workplace health and safety standards. Its functions bear on the health and safety of the entire workforce of the State, and consequently the health and safety wider community as it is affected by workplace practices. 9. Ideally, as we see it, the organisation should point to a single statement that covers the points required by HPP 6(1). Where the organisation, as it often well be, is a complex one with diverse personal information handling responsibilities (as seen in a major agency such as WorkCover or a major hospital), the statement might have a two or three step quality, with the primary statement being in relatively general terms and referring the reader to specific parts of subordinate documents for further information (such as the relevant paragraphs of a Privacy Management Plan). 10. The statement(s) on which the organisation relies should, as we see it, be sufficient to enable an ordinary member of the community to ascertain the answer to the matters listed in HPP 6(1)(a), (b) and (c), not just someone endowed with special skills in chasing down information of this kind. HPP 6 compliance notices should be expressed in a way that ensures a wide reach across the affected community. 11. In our view, the normal expectation of an ordinary member of the community trying to find information responsive to HPP 6 would be that there will be a document, easily able to found, which organises the information in way that refers to HPP 6 and directly corresponds with its structure. As already noted, this primary document might contain a summary, or overview statement, that is then fleshed out by one or more linked documents. The objects of the Act are not satisfied, in our opinion, by steps that require the interested individual to undertake a website navigation exercise directed to a host of documents, and tucked-away paragraphs in those documents. We do not consider it satisfactory as a way of demonstrating compliance with such an important obligation to take the reader or the Tribunal on a website tour of bland passages in documents that are not linked in any comprehensible way. 12. We are not satisfied from the material on which the respondent relied that that the Tribunal had any reasonable or persuasive basis for concluding that HPP 6 had been met. In our view there was only one conclusion open to the Tribunal on the basis of the material before it, i.e. that the organisation did not demonstrate compliance with HPP 6 in relation to the kind of health information under notice in this case. 13. Accordingly we enter a finding of contravention of HPP 6. Rulings in respect of HPP 9 1. The appeal put in issue the Tribunal's ruling on this point. The respondent addressed the issue in its notice in reply, but did not supplement the reply in its fuller submissions. 2. HPP 9 provides: 9 Accuracy An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 1. The primary purpose of HRIPA is 'to promote fair and responsible handling of health information' (s 3(1)). This Principle serves that end. 2. HPP 9 seeks to ensure that agencies fairly use information they hold at the point they are taking actions or making decisions based on it. It is especially directed to old information, and seeks to encourage care in relation to the use of information collected indirectly. 3. In contrast to the systemic role played by HPP 6, this is an obligation that applies to the particular circumstances of each case. Whether the organisation has complied will be informed by the evidence as to what occurred in the particular case, and evidence as to the general practices that are observed in the organisation in relation to the type of use made of information of this type. The obligation is expressed in general terms, and leaves wide latitude for judgment, first to the agency in administering the obligation and to the Tribunal on review. 4. Here the report was being used by the inspector at a point where he had formed a negative view as to the prospect's of success of the bullying complaint. The report's contents strengthened his view. The appellant's basic objection is that the report, being one directed to her compensation claim, did not assist with resolution of the specific bullying complaint. Further, if it was seen as 'relevant' to the use for which it was now being employed, then the inspector should have taken steps to notify her of his reliance on it, and given her an opportunity to challenge any aspects that she saw as incorrect or incomplete. 5. The respondent did not take any steps to assess the information and opinions contained in the report for accuracy, recency, completeness, and possible misleading content. It justified its stance, as we read the material, on the basis that it was a professional report done recently, and related to the same conduct that was put in issue by the bullying complaint, though for another purpose, the pursuit of a worker's compensation claim. In essence, it considered that it was reasonable in the circumstances not to make any checks, such as going back to the appellant for comments or input. 6. The Tribunal set out in some detail the respective contentions of the parties. It then proceeded to give its appraisal of the submissions, as follows: 143 I agree with the Respondent that HPP 9 did not require Inspector Dall to determine the relevance of the medical report at the time he was gathering evidence for the purposes of his investigation. 144 The report was produced shortly before it was obtained by the Respondent. In my view the report was "up to date" at the time it was collected and used. 145 I also agree that there was no reason for the Respondent to doubt that Dr Kar honestly held the opinions expressed in the medical report. I accept that the Applicant does not agree with the opinions expressed in the medical report but it does not follow that it is inaccurate for the purposes of HPP 9. 146 I agree with the Respondent that no breach of HPP 9 is established. 1. In our view, the Tribunal adequately addressed the question, when read in conjunction with the detailed reference to the respective contentions. 2. This was a professional opinion. It contained recitals of the usual kind seen in reports of this type as to the appellant's circumstances, history and the workplace context. Its recency militated against the need to check it in detail. 3. Clearly, it is less than desirable that the maker of a complaint is not informed, and given the opportunity to respond to any provisional conclusions an inspector is forming in relation to the strength of their complaint, and to be informed of the data that it is being relied upon. But HPP 9 does not contain any requirement as prescriptive as that. 4. Investigations, especially of the present kind where they involve workplace settings, have some complexity insofar as they depend on a level of co-operation from the persons the subject of the allegations for their resolution. The making of a complaint does not, as we see it, give the complainant procedural rights to be involved in the processes of investigation. The HPPs have to be read in a way that accommodates to a reasonable degree the practicalities of investigation, and the desirability that investigations take place and are finalised quickly, especially where they deal with a continuing set of workplace relationships. 5. The finding was one open to the Tribunal. Ruling in respect of HPP 10 1. The basic rule is that an organisation that holds information should only use the health information in its possession for its primary purpose. In HPP 10 this is expressed in a double negative way, i.e. 'An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: [followed by a series of exceptions (a) to (k)]'. 2. This provision requires a judgement to be made as to the primary purpose. 3. The Tribunal upheld the respondent's submission that it had used the information (the medical report) for the primary purpose for which it was collected by the respondent, i.e. investigation of the bullying complaint. This was, of course, not the primary purpose for which the report writer collected the appellant's health information. The psychiatrist's primary purpose was to provide the insurer with a considered opinion to be used in relation to a worker's compensation claim. 4. In the scheme of the legislation, collection can be either 'direct' (from the individual) or 'indirect' (from a third party source). It follows therefore that the primary purpose for which the third party collected the information may not be the primary purpose of a subsequent collector (such as the inspector in this case). Accordingly, it was open to the Tribunal to accept that the purpose for which the agency collected the information was different from the purpose for which the original collector obtained the information, and that the second collector's purpose was the 'primary purpose' in this instance. Therefore it followed that it should find, as it did, that the agency complied with the basic rule of HPP 10. 5. Read in this way, then the Tribunal's first conclusion is correct, that the agency complied with HPP 10(1)'s primary rule. 6. In the alternative the respondent submitted that if it was using the information for a 'secondary purpose', then HPP 10(2) applied. It did not claim that its secondary use fell within any of the exceptions in HPP 10(1). It argued instead that it had the benefit of the dispensation from compliance given by HPP 10(2) which provides: (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). 1. The Tribunal referred to the relevant case-law in relation to the interpretation of this provision. It held, in the alternative, that the conduct put in issue would fall within the scope of para (b). In particular it noted that this provision required a broad judgment, and not one that engaged in a close examination of whether the conduct was lawful in the strict sense under the other law (by virtue, in particular, of the use of the words 'reasonably contemplated'). 2. We are satisfied that this case fell within the basic rule, and we will not consider the additional issue of whether, if it did not, the dispensation given by HPP 10(2) applied. Ruling in respect of HPP 11 1. Finally, the Tribunal found that there was no external disclosure by the agency of the report, therefore HPP 11 limiting external disclosures was not engaged. 2. The alleged 'disclosure' referred to the provision of the report by Inspector Dall to his supervisor, Mr Irwin. It is well established that the 'use' to which principles such as the HPPs refer is the internal use of information within the regulated entity, here the 'organisation'; while the 'disclosure' to which principles such as the HPPs refer is the external disclosure of the information to a person, body or entity other than the 'organisation' that holds the information. The circumstance that the appellant put in issue do not raise any 'disclosure' issue. We agree that HPP 11 was not engaged. Leave to Extend 1. Though styled questions of law, the other matters canvassed in the notice of appeal, in particular the points that appear at paragraph 8 of the notice of appeal, are all in the nature of challenges to observations of a factual kind made by the Tribunal in the course of its reasons. 2. As noted already the process adopted by the Tribunal was to hear the matter on the papers. Consequently, the Tribunal had before it the uncontested affidavit evidence of officers, together with the bundle of administrative documents lodged by the respondent; and the uncontested evidence of the appellant. Further it regard to submissions of the parties, which included submissions as to the proper interpretation and application of the HPPs to the circumstances. 3. The points of appeal at paragraph [8] refer to specific observations found at eleven points of the reasons to which the appellant objects. In our view, these were factual observations at the margins of the case. 4. This is a case where the essential factual circumstances were not in dispute. The respondent was frank in relation to such matters as the continuation of the investigation beyond the point at which the appellant might reasonably have formed the view that had been completed, the respondent's collection and consideration of the medical report, its non-communication of that fact to the appellant, and the practices it had followed in relation to the handling and safekeeping of the report within the agency. In these circumstances, it is not appropriate, or conducive to resolution of this case, to reopen for consideration specific statements made at the various points of the reasons identified in paragraph 8 and the submissions. Order 1. The appeal is allowed in relation to the ruling of the Tribunal that the organisation did not contravene HPP 6. 2. That ruling is set aside. 3. Instead a finding is substituted that the respondent contravened HPP 6. 4. Otherwise, the appeal is dismissed. 5. The application is remitted to the Tribunal for the making of orders in relation to the contraventions found by it, and the additional contravention the subject of Order 3. I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 10 July 2015